mirror of
https://github.com/kubevela/kubevela.git
synced 2026-08-27 16:17:34 +00:00
Fix: Unbundle the X-Definition Validation from Authentication Features (#6904)
Signed-off-by: Brian Kane <briankane1@gmail.com>
This commit is contained in:
Brian Kane
@@ -152,10 +152,10 @@ helm install --create-namespace -n vela-system kubevela kubevela/vela-core --wai
|
||||
| `kubeClient.qps` | The qps for reconcile clients | `400` |
|
||||
| `kubeClient.burst` | The burst for reconcile clients | `600` |
|
||||
| `authentication.enabled` | Enable authentication framework for applications | `false` |
|
||||
| `authentication.definitions.enabled` | Enable definition permission validation (requires authentication.enabled) | `false` |
|
||||
| `authentication.withUser` | Application authentication will impersonate as the request User | `true` |
|
||||
| `authentication.defaultUser` | Application authentication will impersonate as the User if no user provided in Application | `kubevela:vela-core` |
|
||||
| `authentication.withUser` | Application authentication will impersonate as the request User (must be true for security) | `true` |
|
||||
| `authentication.defaultUser` | Application authentication will impersonate as the User if no user provided or withUser is false | `kubevela:vela-core` |
|
||||
| `authentication.groupPattern` | Application authentication will impersonate as the request Group that matches the pattern | `kubevela:*` |
|
||||
| `authorization.definitionValidationEnabled` | Enable definition permission validation for RBAC checks on definitions | `false` |
|
||||
| `sharding.enabled` | When sharding enabled, the controller will run as master mode. Refer to https://github.com/kubevela/kubevela/blob/master/design/vela-core/sharding.md for details. | `false` |
|
||||
| `sharding.schedulableShards` | The shards available for scheduling. If empty, dynamic discovery will be used. | `""` |
|
||||
| `core.metrics.enabled` | Enable metrics for vela-core | `false` |
|
||||
|
||||
@@ -30,11 +30,35 @@ Welcome to use the KubeVela! Enjoy your shipping application journey!
|
||||
|
||||
You can refer to https://kubevela.io for more details.
|
||||
|
||||
{{- if and .Values.authentication.enabled (not .Values.authentication.definitions.enabled) }}
|
||||
{{- if and .Values.authentication.enabled (not .Values.authentication.withUser) }}
|
||||
|
||||
WARNING: Authentication is enabled but definition permission validation is disabled.
|
||||
Applications can reference definitions without RBAC checks.
|
||||
To enable definition permission validation:
|
||||
--set authentication.definitions.enabled=true
|
||||
Ensure users have appropriate RBAC permissions before enabling.
|
||||
WARNING: Authentication is enabled but withUser is disabled.
|
||||
This configuration provides NO security benefit:
|
||||
- All applications will run as '{{ .Values.authentication.defaultUser }}' regardless of who creates them
|
||||
- User groups matching '{{ .Values.authentication.groupPattern }}' are still collected but not used effectively
|
||||
- Service account annotations are blocked
|
||||
|
||||
To enable true user impersonation for security:
|
||||
--set authentication.withUser=true
|
||||
{{- end }}
|
||||
|
||||
{{- if and (not .Values.authorization.definitionValidationEnabled) (not .Values.authentication.enabled) }}
|
||||
|
||||
SECURITY RECOMMENDATION: Both authentication and definition validation are disabled.
|
||||
If KubeVela is running with cluster-admin or other high-level permissions,
|
||||
consider enabling one or both security features:
|
||||
|
||||
1. Authentication with impersonation (recommended for multi-tenant environments):
|
||||
--set authentication.enabled=true
|
||||
--set authentication.withUser=true
|
||||
This makes KubeVela impersonate the requesting user, applying their RBAC permissions.
|
||||
Note: Both flags must be enabled for user impersonation to work.
|
||||
|
||||
2. Definition permission validation (lightweight RBAC for definitions):
|
||||
--set authorization.definitionValidationEnabled=true
|
||||
This ensures users can only reference definitions they have access to.
|
||||
|
||||
Using both features together provides defense in depth.
|
||||
Without these protections, users can leverage KubeVela's permissions to deploy
|
||||
resources beyond their intended access level.
|
||||
{{- end }}
|
||||
|
||||
@@ -313,8 +313,8 @@ spec:
|
||||
- "--feature-gates=DisableWorkflowContextConfigMapCache={{- .Values.featureGates.disableWorkflowContextConfigMapCache | toString -}}"
|
||||
- "--feature-gates=EnableCueValidation={{- .Values.featureGates.enableCueValidation | toString -}}"
|
||||
- "--feature-gates=EnableApplicationStatusMetrics={{- .Values.featureGates.enableApplicationStatusMetrics | toString -}}"
|
||||
- "--feature-gates=ValidateDefinitionPermissions={{ .Values.authorization.definitionValidationEnabled | toString -}}"
|
||||
{{ if .Values.authentication.enabled }}
|
||||
- "--feature-gates=ValidateDefinitionPermissions={{ .Values.authentication.definitions.enabled | toString -}}"
|
||||
{{ if .Values.authentication.withUser }}
|
||||
- "--authentication-with-user"
|
||||
{{ end }}
|
||||
|
||||
@@ -290,18 +290,27 @@ kubeClient:
|
||||
burst: 600
|
||||
|
||||
## @param authentication.enabled Enable authentication framework for applications
|
||||
## @param authentication.definitions.enabled Enable definition permission validation (requires authentication.enabled)
|
||||
## @param authentication.withUser Application authentication will impersonate as the request User
|
||||
## @param authentication.defaultUser Application authentication will impersonate as the User if no user provided in Application
|
||||
## SECURITY NOTE: When enabled WITH authentication.withUser=true, KubeVela impersonates the requesting user
|
||||
## when deploying resources, ensuring that users cannot deploy resources beyond their RBAC permissions.
|
||||
## This is strongly recommended when KubeVela has cluster-admin or other high-level permissions.
|
||||
## @param authentication.withUser Application authentication will impersonate as the request User (must be true for security)
|
||||
## @param authentication.defaultUser Application authentication will impersonate as the User if no user provided or withUser is false
|
||||
## @param authentication.groupPattern Application authentication will impersonate as the request Group that matches the pattern
|
||||
authentication:
|
||||
enabled: false
|
||||
definitions:
|
||||
enabled: false
|
||||
withUser: true
|
||||
defaultUser: kubevela:vela-core
|
||||
groupPattern: kubevela:*
|
||||
|
||||
## @param authorization.definitionValidationEnabled Enable definition permission validation for RBAC checks on definitions
|
||||
## SECURITY NOTE: If KubeVela is running with cluster-admin or high-level permissions,
|
||||
## consider enabling this feature and/or authentication.enabled for security:
|
||||
## - This feature: Validates users can only reference definitions they have RBAC access to
|
||||
## - authentication.enabled: Makes KubeVela impersonate users, applying their full RBAC permissions
|
||||
## Both features can be used together for defense in depth.
|
||||
authorization:
|
||||
definitionValidationEnabled: false
|
||||
|
||||
## @param sharding.enabled When sharding enabled, the controller will run as master mode. Refer to https://github.com/kubevela/kubevela/blob/master/design/vela-core/sharding.md for details.
|
||||
## @param sharding.schedulableShards The shards available for scheduling. If empty, dynamic discovery will be used.
|
||||
sharding:
|
||||
|
||||
Reference in New Issue
Block a user